FreshPorts - VuXML

This page displays vulnerability information about FreeBSD Ports.

The last vuln.xml file processed by FreshPorts is:

Revision:  487518
Date:      2018-12-15
Time:      15:03:44Z
Committer: joneum

List all Vulnerabilities, by package

List all Vulnerabilities, by date

These are the vulnerabilities relating to the commit you have selected:

VuXML IDDescription
42852f72-6bd3-11e5-9909-002590263bf5OpenSMTPD -- multiple vulnerabilities

OpenSMTPD developers report:

fix an mda buffer truncation bug which allows a user to create forward files that pass session checks but fail delivery later down the chain, within the user mda

fix remote buffer overflow in unprivileged pony process

reworked offline enqueue to better protect against hardlink attacks


Discovery 2015-10-04
Entry 2015-10-06
opensmtpd
lt 5.7.3,1

http://www.openwall.com/lists/oss-security/2015/10/04/2
https://www.opensmtpd.org/announces/release-5.7.3.txt
ee7bdf7f-11bb-4eea-b054-c692ab848c20OpenSMTPD -- multiple vulnerabilities

OpenSMTPD developers report:

an oversight in the portable version of fgetln() that allows attackers to read and write out-of-bounds memory

multiple denial-of-service vulnerabilities that allow local users to kill or hang OpenSMTPD

a stack-based buffer overflow that allows local users to crash OpenSMTPD, or execute arbitrary code as the non-chrooted _smtpd user

a hardlink attack (or race-conditioned symlink attack) that allows local users to unset the chflags() of arbitrary files

a hardlink attack that allows local users to read the first line of arbitrary files (for example, root's hash from /etc/master.passwd)

a denial-of-service vulnerability that allows remote attackers to fill OpenSMTPD's queue or mailbox hard-disk partition

an out-of-bounds memory read that allows remote attackers to crash OpenSMTPD, or leak information and defeat the ASLR protection

a use-after-free vulnerability that allows remote attackers to crash OpenSMTPD, or execute arbitrary code as the non-chrooted _smtpd user


Discovery 2015-10-02
Entry 2015-10-04
Modified 2015-10-06
opensmtpd
lt 5.7.2,1

https://www.opensmtpd.org/announces/release-5.7.2.txt
CVE-2015-7687